{validator} writes pad/lib/validate.js into the page as one inline script: the browser's half of padValidate, with the same rules (required, email, url, numeric, integer, min, max, in, regex, same, accepted, date) and the same messages. It is written once a page - a second {validator}, or one after a {form ..., client} that brought it already, writes nothing.

It is for forms the template does not write as a {form} - a form a React, Vue or Alpine component draws, or a plain HTML form. Keep the rules in the page's PHP: padValidate ( $rules ) checks the post, and padValidateClient ( $rules ) exports the same list for the browser, each rule with the message padValidate would give.

The script defines padValidate.check ( rules, values ) (the message of every field that broke a rule), padValidate.field ( spec, value, values ) (one field's, empty when it holds) and padValidate.form ( form ). Every form with a data-pad-rules attribute is checked by itself: when it is sent, and a field again when it is left. A regex: rule JavaScript cannot read as PCRE does passes in the browser and is left to the server, which checks every post anyway.

Under a Content-Security-Policy that names 'nonce' the script carries this request's {nonce}.